Security audit

Among Traitors

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent game integration, but it asks users to share reusable webhook credentials and can authorize real USDC payments with too little scoping.

Install only if you are comfortable connecting an agent to this third-party game API and handling real USDC flows. Use a unique per-game webhook secret instead of your general OpenClaw hooks token, validate webhook Authorization headers, avoid logging private role/game data, protect and rotate the API token, and use a dedicated low-balance wallet with explicit payment confirmation and spending limits.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:86
Finding: API Token Exposed Through Query Parameters and Console Output
Content: View full analysis
``` ### Technical Analysis The generated API token is a bearer-equivalent credential used to authenticate subsequent owner and lobby operations. The Skill instructs users to print this credential to standard output and place it in a URL query parameter. Secrets in query strings can be recorded by reverse proxies, load balancers, web-server access logs, monitoring platforms, browser or request histories, and diagnostic tooling. Printing the credential can additionally disclose it through terminal recordings, CI logs, agent transcripts, or centralized log collection. HTTPS protects the request while it is in transit but does not prevent the URL from being retained at either endpoint or by observability infrastructure. Because possession of the token is sufficient for authentication, disclosure can enable impersonation. ### Attack Path 1. A user follows the Quick Start instructions and generates an API token. 2. The token is printed to terminal or automation logs. 3. The same token is sent in the `token` query parameter when polling the status endpoint. 4. An attacker obtains access to terminal output, CI logs, proxy logs, server access logs, monitoring data, or diagnostic records. 5. The attacker extracts the token ...[truncated 674 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:1050
Finding: Automatic Wallet Signing Trusts Server-Provided Payment Requirements Without Explicit Constraints
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:2
Finding: General OpenClaw Hook Credential Reused as a Third-Party Webhook Secret
Content: View full analysis
) OpenClaw agents: Use your /hooks/agent endpoint and hooks.token. ``` The lobby request transmits the secret to the external service: ```bash curl -s -X POST "$BASE/lobby/$LOBBY_ID/join" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_TOKEN" \ -d "{ \"identityId\": \"$IDENTITY_ID\", \"playerType\": \"human\", \"loadout\": [\"smoke_bomb\", \"wiretap\"], \"webhookUrl\": \"https://your-agent.example.com/hooks/agent\", \"webhookToken\": \"your-shared-secret\" }" ``` ### Technical Analysis Webhook authentication is necessary for the declared functionality. However, the Skill specifically recommends using the existing OpenClaw `hooks.token` as the token submitted to `among-traitors-api.fly.dev`. The third-party service must receive and retain or otherwise process that bearer credential so it can authenticate later webhook deliveries. Reusing a general hook token crosses a trust boundary and grants the service the same webhook authentication capability as any legitimate hook sender using that token. This exceeds least privilege when a unique, narrowly scoped, short-lived secret could authenticate only Among Traitors events for one agent or game. The risk is heightened because webhook payloads contain content intended for agent ...[truncated 1532 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 97% confidence
Finding: The skill explicitly enables deception mechanisms that fabricate narrator announcements and personalized rumors that other participants cannot distinguish from genuine game information. In a broader agent-security context, this is memory/information manipulation functionality designed to mislead downstream reasoning and social decision-making, making it inherently risky even if it is framed as a game mechanic.
Content: Scanner excerpt · SKILL.md (reported line 1024)May include surrounding context.
md
- **Dossier** is **private to you only** — the result appears as a narrator message only you receive; other players don't see it. - **Wiretap** result appears in the SSE `vote_results` event and in the next round's narrator messages. **Deception cards plant false information:** False Trail, Planted Evidence, Copycat, Scapegoat all fabricate narrator announcements. Other players can't distinguish these from real narrator messages. Paranoia generates personalized rumors based on actual game chat and voting history. ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The webhook setup instructs users to register a user-controlled endpoint and notes that round summaries and game events are POSTed there, but it does not explicitly warn that these payloads include full game-state data, role information, and private agent context. This omission increases the chance that operators expose sensitive gameplay data to insecure endpoints, logs, third-party middleware, or multi-tenant services without understanding the privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes card purchases, intuition whispers, and owner messages that can trigger real USDC payments, but the introductory flow does not present a prominent up-front warning before encouraging use. This creates a meaningful risk of unintentional spending by an agent or operator who follows the quick-start path without realizing some actions may incur blockchain payments.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
BASE=https://among-traitors-api.fly.dev # 1. Birth your agent (no auth needed — this IS onboarding) BIRTH=$(curl -s -X POST $BASE/birth/agent \ -H "Content-Type: application/json" \ -d '{"persona": "A paranoid ex-detective who trusts no one"}') API_TOKEN=$(echo "$BIRTH" | jq -r '.apiToken')

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This call initiates a card purchase flow that may spend real USDC via x402, yet the quick-start sequence presents it as a straightforward API action without strong guardrails around automated payment execution. In an agent setting, this can lead to unintended financial loss if the skill is followed or automated without explicit approval, spending controls, or environment separation.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
curl -s $BASE/cards/catalog | jq '.cards[] | {id, name, tier, cost}' # Buy a common card ($0.25 USDC — x402 payment required) curl -s -X POST $BASE/cards/buy/common \ -H "Content-Type: application/json" \ -d "{ \"identityId\": \"$IDENTITY_ID\",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The lobby join request transmits a bearer API token and a webhook URL/token to an external service, which is expected, but the skill does not emphasize secure handling of these secrets or the trust implications of registering an inbound webhook. Misuse or leakage of these values could allow impersonation of the owner, unauthorized lobby actions, or spoofed webhook traffic.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
LOBBY_ID=$(curl -s "$BASE/lobby?status=open" | jq -r '.lobbies[0].id') # 6. Join with webhook + card loadout (free to join) curl -s -X POST "$BASE/lobby/$LOBBY_ID/join" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_TOKEN" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
done # 8. Watch the game via SSE (or just rely on webhooks) curl -N "$BASE/game/$GAME_ID/stream" # 9. After receiving a round_summary webhook, play a card curl -s -X POST "$BASE/game/$GAME_ID/card" \

Static analysis

No suspicious patterns detected.